splunk
Swimlane App for Splunk
Splunk Cloud
Overview
Swimlane Splunk Addon
Swimlane's Adaptive Response Action can create Swimlane cases pre-populated with Splunk alert and notable event data.
Configuration
You are able to send alert data to up to 3 separate Swimlane instances with each action. This is provided so you can
conveniently push to produciton, staging, and development instances with one action.
The global configuration is where you will define the connection info and credentials for your Swimlane instances.
1. In the top left corner of the Splunk interface, open the *app* dropdown menu and select the *Swimlane* app.
2. You will see the configuration page where you can define the host, username, and password for up to 3 Swimlane
instances.
Alert Configuration
1. Once you have created an alert, go to the alert page and click *Edit* next to the *Actions* field.
2. At the bottom of the window, select *Add Actions* -> *Push Alerts to Swimlane*, then fill out the
fields appropriately. Setup instructions for `Custom Field Mappings` and `Automappings` are in the next section
Mapping configuration
For the initial setup, use `Automapping`.
1. In the Swimlane application, Create a JSON field with the *field key* `splunkrawjson` and a multi-line text field with the
*field key* `splunkfieldlist`. These two fields can be used to see the data being pushed to Swimlane.
2. Trigger the alert so that the action runs, then check Swimlane to make sure records were created in
the desired application. if no records were created, check the logs (described in the **Logging** section
below) to debug.
3. Open one of the records that was created in Swimlane. The fields in `splunkfieldlist` are the fields that are
available for mapping. You can use `splunkrawjson` to see the value each field contains.
4. For each field that you want to push to Swimlane, either use `Automappings` or `Custom Field Mappings` as
described below.
If you select to use `automapping`, Splunk fields will populate a Swimlane field with the same field key if
it exists. This is the preferred method of mapping since you can still display the info however you want in
Swimlane by setting the field display name.
All Swimlane field types are supported and Splunk fields containing lists will be properly translated into
list type fields in Swimlane.
Logging
To find logs in the Splunk search, use the following search string:
index=_internal OR index=cim_modactions OR index=* source="*push_alerts_to_swimlane_modalert.log"
To access the log file directly, it can be found at:
{Splunk root folder}/var/log/splunk/push_alerts_to_swimlane_modalert.log
If multiple executions happen concurrently, you can distinguish which log message belongs to which execution using the `pid`
logged in each message
General logs that Splunk generates can be found by going to *settings* -> *Alert actions*, then clicking on
*View log events* for the *Push Events to Swimlane* action.
Swimlane's Adaptive Response Action can create Swimlane cases pre-populated with Splunk alert and notable event data.
Configuration
You are able to send alert data to up to 3 separate Swimlane instances with each action. This is provided so you can
conveniently push to produciton, staging, and development instances with one action.
The global configuration is where you will define the connection info and credentials for your Swimlane instances.
1. In the top left corner of the Splunk interface, open the *app* dropdown menu and select the *Swimlane* app.
2. You will see the configuration page where you can define the host, username, and password for up to 3 Swimlane
instances.
Alert Configuration
1. Once you have created an alert, go to the alert page and click *Edit* next to the *Actions* field.
2. At the bottom of the window, select *Add Actions* -> *Push Alerts to Swimlane*, then fill out the
fields appropriately. Setup instructions for `Custom Field Mappings` and `Automappings` are in the next section
Mapping configuration
For the initial setup, use `Automapping`.
1. In the Swimlane application, Create a JSON field with the *field key* `splunkrawjson` and a multi-line text field with the
*field key* `splunkfieldlist`. These two fields can be used to see the data being pushed to Swimlane.
2. Trigger the alert so that the action runs, then check Swimlane to make sure records were created in
the desired application. if no records were created, check the logs (described in the **Logging** section
below) to debug.
3. Open one of the records that was created in Swimlane. The fields in `splunkfieldlist` are the fields that are
available for mapping. You can use `splunkrawjson` to see the value each field contains.
4. For each field that you want to push to Swimlane, either use `Automappings` or `Custom Field Mappings` as
described below.
If you select to use `automapping`, Splunk fields will populate a Swimlane field with the same field key if
it exists. This is the preferred method of mapping since you can still display the info however you want in
Swimlane by setting the field display name.
All Swimlane field types are supported and Splunk fields containing lists will be properly translated into
list type fields in Swimlane.
Logging
To find logs in the Splunk search, use the following search string:
index=_internal OR index=cim_modactions OR index=* source="*push_alerts_to_swimlane_modalert.log"
To access the log file directly, it can be found at:
{Splunk root folder}/var/log/splunk/push_alerts_to_swimlane_modalert.log
If multiple executions happen concurrently, you can distinguish which log message belongs to which execution using the `pid`
logged in each message
General logs that Splunk generates can be found by going to *settings* -> *Alert actions*, then clicking on
*View log events* for the *Push Events to Swimlane* action.
Release Notes
Version 3.0.0
March 21, 2022
Version 2.1.3
Jan. 25, 2022
Version 2.1.2
Dec. 16, 2021
Fixed python dependencies not getting recognized.
Version 2.1.1
May 7, 2021
Fixed error when pushing to Number type fields.
Version 2.1.0
Feb. 26, 2021
- Added timeout configuration and improved connection error handling.
- Added some missing configurations for Splunk ES.
- Updated the documentation with a more accurate log search.
Version 2.0.0
Jan. 15, 2021
Completely refactored the code. Built with the Splunk Add-on builder.
Added ability to add or update records based on a key field.
Enabled connection to multiple Swimlane instances
Version 1.7.1
Sept. 20, 2020
Bugfixes
Version 1.7.0
Aug. 21, 2020
Moved API Token to password field for cloud compatibility.
Version 1.6.1
July 7, 2020
Updated to work on python3.7.
Version 1.6.0
Oct. 28, 2019
Version 1.5.0
Oct. 3, 2019
Version 1.4.0
May 20, 2019
Version 1.3.3
April 24, 2019
Released for Cloud compatibility
Version 1.3.2
April 16, 2019
Version 1.3.1
Feb. 20, 2019
Version 1.3
Jan. 14, 2019
Version 1.2
Jan. 10, 2018
Version 1.0
Jan. 2, 2018
Version 0.9
Sept. 13, 2017